PT-2026-34421 · Linux · Linux Kernel

Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-31516

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the xfrm component where a 'XFRM MSG NEWSPDINFO' request can queue the policy hthresh.work work item onto the system workqueue. The callback function xfrm hash rebuild() retrieves the struct net using container of(). If the network namespace is torn down before the work item executes, xfrm hash rebuild() may dereference memory that has already been freed because xfrm policy fini() failed to synchronize policy hthresh.work during the teardown process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31516

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-31516 · Security Note
• https://git.kernel.org/stable/c/56ea2257b83ee29a543f158159e3d1abc1e3e4fe · Note
• https://twitter.com/CVEnew/status/2046979955137941922 · Twitter Post
• https://git.kernel.org/stable/c/8854e9367465d784046362698731c1111e3b39b8 · Note
• https://git.kernel.org/stable/c/4e2e77843fef473ef47e322d52436d8308582a96 · Note
• https://twitter.com/VulmonFeeds/status/2047050583454912522 · Twitter Post
• https://git.kernel.org/stable/c/29fe3a61bcdce398ee3955101c39f89c01a8a77e · Note